Direct and reverse secret-key capacities of a quantum channel 
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We define the direct and reverse secret-key capacities of a memoryless quantum cfiannel as tfie 
optimal rates tliat entanglement-based quantum key distribution protocols can reach by using a 
single forward classical communication (direct reconciliation) or a single feedback classical com- 
munication (reverse reconciliation). In particular, the reverse secret-key capacity can be positive 
for antidegradable channels, where no forward strategy is known to be secure. This property is 
explicitly shown in the continuous variable framework by considering arbitrary one-mode Gaussian 
channels. 

PACS numbers: 03.67.Dd, 42.50.-p, 89.70.Cf 



Since the birth of quantum information both the 
notions of quantum entanglement and memoryless quan- 
tum channel have been fundamental in many theoretical 
investigations. This consideration is particularly true in 
the field of quantum cryptography. On the one hand, 
entanglement distribution is a basic process in the for- 
mulation of quantum key distribution (QKD) protocols 
On the other hand, memoryless quantum channels 
can be seen as the effect of collective attacks, recognized 
as predominant in quantum cryptography after the re- 
cent achievements of Ref. Q. In this paper, we con- 
sider a generic QKD protocol where two honest parties 
(Alice and Bob) extract a secret key from the remote 
correlations that are generated by one of the parties (Al- 
ice) after the distribution of a generic entangled state 
over a memoryless quantum channel. Such a task can 
be assisted by one-way classical communications (CCs) 
which can be forward, i.e., from Alice to Bob, or feed- 
back, i.e., from Bob to Alice. Even if the scenario can 
seem symmetric, it is actually much harder to study the 
feedback-assisted protocols and optimize the correspond- 
ing secret-key rates. The reason relies on the fact that Al- 
ice can actively exploit the information already received 
from Bob for conditioning the subsequent inputs to the 
quantum channel. In this paper we simplify this prob- 
lem by restricting the feedback to a single (and therefore 
final) CC from Bob. Although we make this restriction 
on the feedback strategy, the security performance is still 
remarkable. Under suitable conditions, the correspond- 
ing QKD protocols are in fact able to outperform all the 
known QKD protocols which are based on forward CCs. 

In general, we identify the notions of direct and reverse 
reconciliation [3] with the ones of assistance by a single 
forward and a single feedback CC, respectively. Then, 
by optimizing over corresponding protocols, we define 
the direct and reverse secret-key capacities of a quan- 
tum channel. In direct reconciliation, the optimization 
over a single forward CC is not restrictive at all. In fact, 
the direct secret-key capacity represents an equivalent 



entanglement-based formulation of the (forward) secret- 
key capacity of Ref. [11 . In reverse reconciliation, even 
if the feedback strategy is limited, the security perfor- 
mance is in any case outstanding. In fact, the reverse 
secret-key capacity can bepositive even if the quantum 
channel is antidegradable [6(, i.e., an eavesdropper is able 
to reconstruct completely the output state of the receiver 
(and no forward protocol is known to be secure). This 
property is explicitly shown in the most important sce- 
nario for the continuous variable QKD: the one- mode 
Gaussian channel. In order to establish this result in 
its full generality, we resort to the recent canonical clas- 
sification of the one-mode Gaussian channels Q (see also 
Refs. d, Q). By assuming an arbitrary one- mode Gaus- 
sian channel, we then exploit a general lower bound for 
the reverse secret-key capacity. This bound corresponds 
to the additive capacity of Ref. , which is connected to 
the entanglement distillation by feedback CCs. For one- 
mode Gaussian channels, this additive capacity assumes 
an analytical formula which is exceptionally simple. Most 
importantly, it enables us to prove the positivity of the re- 
verse secret-key capacity over a wide range of parameters 
where the channel is antidegradable. In a final investiga- 
tion, we also prove that tighter bounds can be derived by 
exploiting noise effects in the key-distribution process. 
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FIG. 1: Quantum channel TV and its dilation. 

Let us consider an arbitrary quantum channel, i.e., 
a completely positive trace-preserving (CPT) map A/", 
transforming the input state pA' of a sender (Alice) into 
the output state ps of a receiver (Bob). As depicted in 
Fig. [ll such a channel can always be represented by an 
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is characterized by the formula 13, l3| 



Kt.{M) = lim - max [I{X : B''\T) - I{X : S"|T)] , 

n^oo n ^",Ma 

where the maximum is over all the pure states Al- 
ice's POVAls M.A, and all the classical channels p{t\x) : 
X ^ T generating the conditioning dummy variable T. 
In this formula, I{X : B"\T) and I{X : E'^lT) are the 
conditional Holevo information of Bob and Eve [3] ■ In 
direct reconciliation, one can show [l3| that the condi- 
tioning by T can actually be avoided in the previous for- 
mula, and that (A/") is the entanglement-based version 
of the secret-key capacity K{J\f) of Ref. [5^. From Ref. [H| 
it is known that K{Af) > E{M) = Q(7V), where E{M) 
is the entanglement-generation capacity of M and Q{N) 
its unassisted quantum capacity 
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isometric embedding U^f : Ha' 'Hb®'He followed by a 
trace over the environment E which we identify with the 
eavesdropper (Eve). By definition, the original channel 
J\f is called degradable if there exists a CPT map V such 
that pe = T^^pb), where pE is the output state of Eve. 
By contrast, M is called antidegradable if there exists a 
CPT map V such that pb — T^ips)- A further dilation 
of the quantum channel is provided by the purification 
of the input pA' = Tr^$ with <i> := |$) (^'1^^/, involving 
the introduction of a supplementary system A at Alice's 
side. Notice that the three output systems A, B and E 
are globally described by a pure state vE" = |*) {^\abe^ 
which is given by \E' = {I a ® A key-distribution 

protocol can be introduced by extending the scenario of 
Fig. [1] to n (entangled) uses of the channel and by adding 
measurements to Alice's and Bob's sides. Restricting the 
honest users to a single one-way CC, we have a one-way 
key-distribution protocol which can be direct, if Alice as- 
sists Bob, or reverse, if Bob assists Alice. 

Let us begin with the direct protocol. In the first 
step of this protocol, Alice distributes a pure entangled 
state $" := |$) ('I'l^n^/n sending the A'-part through 
the memoryless quantum channel A/"®" = N ® ■ ■ ■ ® N 
(see Fig. [2]). As a consequence, we have a pure state 

= (/^ (X)t/j^)®" (<!>"), shared by the output systems of FIG. 3: Key-distribution protocol in reverse reconciliation. 
Alice (A"), Bob (B") and Eve {E"^). On her local sys- 
tems A", Alice performs a quantum measurement AAa- 
This is generally described by a positive operator-valued 
measure (POVM) {A^} with outcomes x. As a result, she 
gets an output random variable X = {x,p{x)} where the 
values X have probability distribution p{x) — Tr(5'"A^). 
After the measurement, Alice processes X via a classi- 
cal channel X — ^ [SatL), which yields a key variable 
Sa = {s,p{s)} and an assisting variable L = {l,p{l)}. 
The assisting variable L contains all the information nec- 
essary to Bob for performing error correction and privacy 
amplification. The value Z of L is then broadcast by Alice 
through a public channel. Using this information. Bob 
performs a conditional POVM AA.b\l = {sP} on his 
systems B", and retrieves an estimation of Alice's key 
S'j^ up to an error probability p{Sa S*^) < £ flit . 
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A key-distribution protocol in reverse reconciliation, 
i.e., a reverse protocol^ consists of interchanging Alice 
and Bob in terms of the assisting CC while keeping Alice 
as dispenser of the quantum state As we have al- 
ready mentioned, this is a particular case of a more gen- 
eral feedback-assisted protocol, where Alice distributes 
the entangled state $" in n different rounds, each one 
conditioned by previous CCs received from Bob. In the 
first step of a reverse protocol, Alice distributes $" gen- 
erating as before (see Fig. [3]). But now the first 
measurement is done by Bob, who detects his systems 
_B" via a POVM A4b, generating an output variable 
Y = {y,p{y)}- Again, this variable is processed into 
a key variable Sb and an assisting variable M , which is 
broadcast by Bob. Using this information, Alice subjects 
her local systems A" to a conditional POVM Ma\m^ re- 
trieving an estimation of Bob's key S'^ up to a small error 
probability. The reverse secret-key capacity K^{M) of a 
quantum channel TV is defined as the highest secret-key 
rate which is achievable by reverse protocols over TV. For 
this capacity we can prove the upper bound [Ulil 



FIG. 2: Key-distribution protocol in direct reconciliation. 

In the limit of rt ^ +oo, Alice and Bob are able to rule 
out Eve completely and share exactly the same uniform 
key Sa corresponding to H{Sa) '■= nR secret bits. The 
highest secret-key rate R which is achievable by direct 
protocols over a quantum channel TV is called the direct 
secret-key capacity (TV) of the channel. This quantity 



K^iM) < lim - max [I{Y : A"|r) - I{Y : £;"|T)] , 

n— >cx) ri ^",Mb 

where the maximum is now over Bob's POVMs A4b and 
involves the processing of Bob's variable Y. 

In order to find achievable lower bounds for this ca- 
pacity, let us restrict the process of key-distribution to 
the one of key-distillation. A one-way key -distillation 
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protocol over a channel Af (in direct or reverse recon- 
ciliation) is defined as a one-way key-distribution pro- 
tocol where the input state is separable over different 
uses of the channel, i.e., <&" = Maximizing over 

these protocols, we can define the direct and reverse key- 
distillation capacities of a quantum channel, that we de- 
note by fsr^(7V) and K^^Af). These capacities clearly 
satisfy K^iAf) < KJM) and K'^{I\f) < K^{M). Using 
the results of Ref. [l6|, we can easily prove the formu- 

13, [H 
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K®{M) = lim - max [I{X : B''\T) ~ I{X : E''\T)] , 
K®{M) = lim - max [I{Y : A"\T) - I{Y : i;"|T)] , 

n^oo n ^,Mb 

where now the maximization is over the single copy of the 
state i.e., over Exploiting the relation with the 

key-distillation, we can prove an important lower bound 
for K^{N). In fact, we have [H 

K^{N) > K^{M) > E^^HM) = Er{M) , (1) 

where Ej^{Af) is the additive capacity of Ref. [13] ■ In 
particular, the single-letter version of this capacity is 
given by the formula E^j^^Af) := max|$^ I{A{B), where 
I{A{B) := H{pa) — H{pab) is the reverse coherent in- 
formation computed over Alice and Bob's output state 
PAB — (I A €5 A/") (<i>) . Remarkably, Eni-Af) has a very 
different behavior with respect to the quantum capacity 
Q{J\f). In particular, for an antidegradable channel, we 
can have En.{M) > which implies K^{J\f) > 0. In the 
following this is explicitly shown for a generic Gaussian 
channel affecting a single bosonic mode. 

Recall that a bosonic mode is a quantum system de- 
scribed by a pair of quadrature operators, q and p, with 
[q,p\ — 2i. Then, a Gaussian channel G acting on this 
system is a CPT map which preserves the Gaussian 
statistics of its states. Using the compact formulation 
of Ref. [1] , every G can be associated with three symplec- 
tic invariants: transmission r, rank r, and temperature 
n. These invariants completely characterize the unique 
canonical form [3| C{T,r,n) which is unitarily equivalent 
to Q (see Fig.|4|). For a generic one-mode Gaussian chan- 
nel g with transmission t ^ 1, we compute [l3| 



£;fl,(g) =max<^0,log 



1 



-gin) 



(2) 



where g(x) :— (x-l- 1) log(x-|- 1) — a; logx. This expression 
must be compared with 



Q^^-o^iG) = max<{ O,log 



- 5(") 



(3) 



which is the quantum capacity Q{G) restricted to a sin- 
gle use of the channel and pure Gaussian states 0]. It 



is known that Q{Q) = Q^^'^\G) for a degradable chan- 
nel [l^, while Q{G) = for an antidegradable channel. 
In order to analyze and compare the previous quantities, 
we introduce the scaled thermal noise e := 2fT,|l — t|. 
For every t ^ 1, we then consider the minimal noises, 
eq and en., above which we have Q^^'^^(f/) = and 
Er{G) — 0, respectively. The corresponding threshold 
curves eg — £q(t) and er = £r{t) are shown in Fig. [5l 
For r < 1/2, the one-mode Gaussian channel is known to 
be antidegradable [3| and, therefore, we have Q{G) — 0. 
In this case, no forward protocol is known to be secure, 
i.e., it is not known if K{G)[— K^{G)] ^ 0. However, 
for < r < 1/2 and e < e_R(r), we have a wide re- 
gion of antidegradability where EniG) > and, there- 
fore, {G) > 0. In other words, even if Eve can recon- 
struct Bob's state, Alice and Bob are still able to extract 
a secret key using a reverse protocol. This result is a 
remarkable feature of the reverse reconciliation, which is 
here stated in its full generality by considering arbitrary 
one-mode Gaussian channels. 
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FIG. 4: Canonical decomposition. In the center of the 
figure (Eve), we show the decomposition of a one-mode Gaus- 
sian channel Q into a canonical form C{T,r,n) up to a pair of 
unitaries U and [/'. Noisy reverse protocol. The reverse 
protocol with the rate of Eq. Q is achieved by applying two 
inverse unitaries and U'~^ (not shown in the figure), re- 
stricting the quantum distribution to a two-mode squeezed 
vacuum state "1> = j/i) {/ij, and providing Alice and Bob with 
homodyne detectors (see boxes in the figure). In particular, 
Bob's homodyne detector is placed after one of the two out- 
put ports of a balanced beam-splitter mixing the signal with 
the vacuum (the output of the other port is discarded). 

As a final investigation, we prove an effective separa- 
tion between and En, i.e., the existence of tighter 
lower bounds for K^. In particular, we show a reverse 
key-distillation protocol whose rate can outperform 
EniG), so that we have K^{G) ^ Er{G) and, there- 
fore, K^{G) ^ Er[G)- This protocol exploits a noisy 
decoding measurement as in Ref. [l9| and works as fol- 
lows. For every G, Alice and Bob can in principle apply 
two input-output unitaries that put G in canonical form. 
Assuming this reduction, Alice distributes n copies of a 
two- mode squeezed vacuum state with variance /i 

[20| . At the output of the channel, Bob's measurement 
setup consists of a balanced beam-splitter followed by a 
random homodyne detection of q or p, as shown in Fig. 3] 
The corresponding outcomes are classically processed to 
provide the two variables Sb and M . Then, Bob broad- 
casts the value of the assisting variable M , containing 
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also the correct sequence of q and p detections. As a 
consequence, Alice performs the same sequence of ho- 
modyne detections on her systems A" and then applies 
error-correction and privacy amplification to get her es- 
timation of the key S'g. In the limits for n — > -|-oo and 
/i +00 (and for t 7^ 1), the honest users achieve the 
secret-key rate 

= max {0, i log ^ + .9 (y^ ~ \) ~ 9{n)} , (4) 

where A :— (|1 — t| +w)/{1 + |1 — r| w) and w := 2n+ 1. 
Let us denote by = £■<(■'') the security threshold cor- 
responding to = 0. As shown in Fig. [SI there is a 
whole region for < t < 2 and er < e < e^, where 
i?4 > Eii{Q) — 0. As a consequence, we generally have 
K^iG) + Er[Q) and, therefore, K^{Q) ^ ER{g). Notice 
that when Q is just a canonical form, the previous pro- 
tocol can be implemented in practice, without the help 
of any quantum memory. Alice and Bob can in fact per- 
form their detections step-by-step and then keep only the 
data measured in the same basis (g or p). In this case 
the rate R^ of Eq. ^ refers to the sifted-key after the 
basis reconciliation. 




FIG. 5: Scaled thermal noise e versus transmission r 7^ 1. 
The thin solid curve eg — eq^t) refers to Q^^'^\G), while the 
thick solid curve er = er{t) refers to Er(Q). Above (below) 
these curves the corresponding capacities are zero (positive). 
Notice that Er{Q) is positive in the region < r < 1/2 and 
E < er{t), where the channel is antidegradable. The dashed 
curve E^ = E^ (r) corresponds to = 0, where R^ is the 
rate given in Eq. (U). 

In conclusion, we have introduced the notions of direct 
and reverse secret-key capacities of a quantum channel, 
specifying these notions for key-distillation too. In par- 
ticular, the reverse capacities and extend the 
concept of reverse reconciliation to a completely general 
scenario, where this procedure must be intended as a 
classical assistance by means of a single feedback CC. 
Such reverse capacities are lower bounded by an additive 



quantity Er, which is connected with entanglement dis- 
tillation and has been explicitly computed for one-mode 
Gaussian channels. For these channels, we have shown 
that the property of antidegradability does not necessar- 
ily preclude the possibility to extract a secret key. This 
is proven in full generality without any restriction on the 
Gaussian model. In other words, we have not restricted 
the one-mode Gaussian channel to any specific descrip- 
tion like, e.g., a beam-splitter with a thermal input. In 
this general scenario, we have also shown an explicit pro- 
tocol which proves an effective separation between 
and Er. In future works, our results can be exploited for 
exploring the ultimate cryptographic properties of arbi- 
trary quantum channels. 
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